Over the last few years, the trend for client-side (browser) applications has really taken off.
For my latest project, I have decided to try and move with the times and write a client-side application.
Part of this application involves sending transaction emails to users (for example, validate signup, password reset emails, etc.). I am using a third-party API to send the emails.
Normally I would have my application running on a server. I would call the third-party API from code on my server.
Running a client-side application means this now needs to happen on a user's browser. The third-party API provides the necessary JavaScript files to achieve this.
The first glaring issue I can see is I need to use an API key. This would normally be safely stored on my server, but now presumably I will need to provide this key to the client browser.
Assuming I can get round this problem, the next problem is what stops a tech-savvy user loading up the JavaScript developers tool on a browser and using the email API anyway they like, rather than say adhering to any rules I have set in the application.
I guess my general question is - how can we prevent malicious use of a client-side application?